Based on discussion with @bettes today, we are probably OK dropping the drag functionality from toggle controls (Alan did not even know we are supporting this).

We have the following options:
1) Modify paper-toggle to not support dragging (via some new attribute maybe)
2) Replace paper-toggle with our own implementation, which is more aligned with our overall direction of reducing exposure to paper-* elements in favor of our own Chrome optimized elements.

Note that the error is thrown even with the newer cr-toggle implementation. Pasting below:

Unchecked runtime.lastError while running developerPrivate.updateExtensionConfiguration: This action requires a user gesture.

It seems that something within updateExtensionConfiguration is erroneously determining that there is no active user gesture, even though there is one. Related code is at [1]

[1] https://cs.chromium.org/chromium/src/chrome/browser/extensions/api/developer_private/developer_private_api.cc?type=cs&q=updateExtensionConfiguration&sq=package:chromium&l=684

This indeed a [problem/feature] in blink - click + drag != user gesture.  If we were to use a web API here that required user gesture (say, webkitRequestFullscreen), we see the same problem.  I don't know if this is something that we want to change on the open web: do we want to consider a click-n-drag to be a user gesture for the case of powerful APIs?

dcheng@, do you have any ideas, or know who would?

(Regardless of the answer for the larger web, if need be, we can change this requirement for extension WebUI, but it's a shame if we need to)

@rdevlin.cronin: Just pasting document.body.requestFullscreen() in the Dev tools of chrome://settings or chrome://extensions seems to work for me. I doubt that pasting something in the console is considered a user gesture.

Are we sure that developerPrivate user-gesture detection is simply based on Blink's user detection?

Actually, pasting something in the console *is* considered a gesture.  Try:

setTimeout(function() {
  document.body.webkitRequestFullscreen();
}, 3000);

And yes, extension APIs all use blink's detection of user gesture:
https://chromium.googlesource.com/chromium/src/+/05655615e0d589c91440c1adc2c3329593263293/extensions/renderer/request_sender.cc#108

(Additionally, if you were to replace the line that actually calls the extension API [1] with something like this.webkitRequestFullscreen(), you will also see the user gesture error in the console).

[1] https://chromium.googlesource.com/chromium/src/+/aa3643958e427e2603132945b5601deb87187e71/chrome/browser/resources/md_extensions/detail_view.js#147

Heh, ok, good to know.

The fun fact is that I tried the snippet you pasted before I post comment#4, but apparently if I use a small value (up to 1000ms), it is still considered a user gesture and it works. 3000ms indeed throws the warning in the console.

Yep, for in-process gestures, we use a timeout of exactly 1 second.

https://chromium.googlesource.com/chromium/src/+/950d94cd80b32ec2854d249b86ee926f36e56f80/third_party/WebKit/Source/core/dom/UserGestureIndicator.cpp#17

@rdevlin: Do we have a clear path forward with this issue? Per my understanding our options are one of the following:

1) Remove the user gesture check in chrome.developerPrivate.updateExtensionConfiguration
2) Figure out why Blink gesture detection logic misses this user gesture and fix.

Adding the Blink tag, hoping that someone from the Blink team can chime in. Feel free add specific Blink people to this thread.

Setting component to Blink>DOM because that's the directory that has the code in question.

Ping, any updates here?

@9 Removing the user gesture requirement is probably fine as a workaround, but it's not the right solution, since this affects other APIs on the web.  I can't comment on if/when the blink issue will be fixed, though.

CL candidate at https://chromium-review.googlesource.com/734707.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/198dbc69cf3f9d5e67e00648e96d5347ba8c942c

commit 198dbc69cf3f9d5e67e00648e96d5347ba8c942c
Author: dpapad <dpapad@chromium.org>
Date: Wed Oct 25 01:04:45 2017

MD Extensions: Remove user gesture check from updateExtensionConfiguration.

This relaxes chrome.developerPrivate updateExtensionConfiguration API to not
require a user gesture. Unfortunately a user gesture is erroneously not detected
when the user drags a toggle UI control.

Bug:  764129 
Change-Id: I08f038a7406a19dd2607206fa1b59aca2bf07ce8
Reviewed-on: https://chromium-review.googlesource.com/734707
Commit-Queue: Demetrios Papadopoulos <dpapad@chromium.org>
Reviewed-by: Devlin <rdevlin.cronin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#511323}
[modify] https://crrev.com/198dbc69cf3f9d5e67e00648e96d5347ba8c942c/chrome/browser/extensions/api/developer_private/developer_private_api.cc
[modify] https://crrev.com/198dbc69cf3f9d5e67e00648e96d5347ba8c942c/chrome/browser/extensions/api/developer_private/developer_private_api_unittest.cc